Received-SPF: pass (google.com: domain of linux-nfs-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Date:   Fri, 20 Nov 2020 19:59:32 -0500
To:     Chuck Lever <chuck.lever@oracle.com>
Cc:     linux-nfs@vger.kernel.org
Subject: Re: [PATCH v2 001/118] NFSD: Fix returned READDIR offset cookie
Message-ID: <20201121005932.GD7705@fieldses.org>
References: <160590425404.1340.8850646771948736468.stgit@klimt.1015granger.net>
 <160590443133.1340.6772360578279663543.stgit@klimt.1015granger.net>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <160590443133.1340.6772360578279663543.stgit@klimt.1015granger.net>
User-Agent: Mutt/1.5.21 (2010-09-15)
From:   bfields@fieldses.org (J. Bruce Fields)
Precedence: bulk

On Fri, Nov 20, 2020 at 03:33:51PM -0500, Chuck Lever wrote:
> Code inspection shows that the server's NFSv3 READDIR implementation
> returns the same offset cookie as the client sent, instead of the
> last cookie it returns in the reply's dirlist. This is unlike the
> NFSv2 READDIR, NFSv3 READDIRPLUS, and NFSv4 READDIR implementations,
> and it's been like this since the beginning of kernel git history.

Surely this should have caused actual failures in practice.

> I copied the logic from nfsd3_proc_readdirplus().
> 
> Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
> ---
>  fs/nfsd/nfs3proc.c |    7 ++++---
>  1 file changed, 4 insertions(+), 3 deletions(-)
> 
> diff --git a/fs/nfsd/nfs3proc.c b/fs/nfsd/nfs3proc.c
> index d9be589fed15..e0ad18d6b5a8 100644
> --- a/fs/nfsd/nfs3proc.c
> +++ b/fs/nfsd/nfs3proc.c
> @@ -430,6 +430,7 @@ nfsd3_proc_readdir(struct svc_rqst *rqstp)
>  	struct nfsd3_readdirargs *argp = rqstp->rq_argp;
>  	struct nfsd3_readdirres  *resp = rqstp->rq_resp;
>  	int		count = 0;
> +	loff_t		offset;
>  	struct page	**p;
>  	caddr_t		page_addr = NULL;
>  
> @@ -448,7 +449,9 @@ nfsd3_proc_readdir(struct svc_rqst *rqstp)
>  	resp->common.err = nfs_ok;
>  	resp->buffer = argp->buffer;
>  	resp->rqstp = rqstp;
> -	resp->status = nfsd_readdir(rqstp, &resp->fh, (loff_t *)&argp->cookie,

Doesn't nfsd_readdir() update argp->cookie to point to the last offset?

> +	offset = argp->cookie;
> +
> +	resp->status = nfsd_readdir(rqstp, &resp->fh, &offset,
>  				    &resp->common, nfs3svc_encode_entry);
>  	memcpy(resp->verf, argp->verf, 8);
>  	count = 0;
> @@ -464,8 +467,6 @@ nfsd3_proc_readdir(struct svc_rqst *rqstp)
>  	}
>  	resp->count = count >> 2;
>  	if (resp->offset) {
> -		loff_t offset = argp->cookie;

So, this shouldn't be equal to the initial cookie any more.

Am I missing something?

--b.

> -
>  		if (unlikely(resp->offset1)) {
>  			/* we ended up with offset on a page boundary */
>  			*resp->offset = htonl(offset >> 32);
>